# Dependency Auditing and License Compliance Checking: A Complete Guide to the Claude Skills Tool

> Master dependency auditing and license compliance checking with the Claude Skills pure-Python tool. Detect SPDX licenses, evaluate compatibility, and generate CI/CD reports.

- Repository: [Alireza Rezvani/claude-skills](https://github.com/alirezarezvani/claude-skills)
- Tags: how-to-guide
- Published: 2026-03-09

---

**The Claude Skills repository provides a self-contained, pure-Python tool that scans project dependencies, detects SPDX licenses, evaluates compatibility against a configurable matrix, and generates detailed compliance reports suitable for CI/CD enforcement.**

Dependency auditing and license compliance checking ensures that third-party packages do not introduce legal conflicts or incompatible obligations into your codebase. The `alirezarezvani/claude-skills` repository ships a zero-dependency utility located at [`engineering/dependency-auditor/scripts/license_checker.py`](https://github.com/alirezarezvani/claude-skills/blob/main/engineering/dependency-auditor/scripts/license_checker.py) that performs deep license analysis using only Python’s standard library. This article explains the architecture, usage patterns, and integration strategies for automating license compliance in software projects.

## How the LicenseChecker Class Orchestrates Analysis

The audit engine centers on the **`LicenseChecker`** class, which encapsulates the entire workflow from dependency discovery to report generation. During initialization, the constructor loads three critical data structures that remain extensible without modifying core logic.

### Building the License Database and Compatibility Matrix

In `__init__`, the checker invokes `_build_license_database()`, `_build_compatibility_matrix()`, and `_build_license_patterns()` to prepare for analysis. The license database maps SPDX identifiers—such as **MIT**, **Apache-2.0**, **GPL-2.0**, and **AGPL-3.0**—to metadata including license type (permissive, copyleft, proprietary, or unknown), risk levels, and legal obligations. The compatibility matrix functions as a two-dimensional lookup table that determines whether a project’s license can legally incorporate a specific dependency license; for example, the matrix records that MIT is compatible with BSD-3-Clause but flags potential conflicts with GPL-2.0.

### Pattern-Based License Detection

When package metadata lacks explicit SPDX declarations, the tool falls back to `_detect_license_from_text()`, which uses regex patterns built by `_build_license_patterns()`. These patterns recognize common license boilerplate inside plain-text LICENSE files, allowing the scanner to identify MIT or Apache-2.0 clauses even when developers omit standardized metadata.

## Running Dependency Audits

The tool supports two primary workflows: command-line execution for CI pipelines and programmatic invocation for custom automation.

### Command-Line Interface

The `main()` function in [`license_checker.py`](https://github.com/alirezarezvani/claude-skills/blob/main/license_checker.py) uses `argparse` to expose a comprehensive CLI. You can scan a project root directly or supply a pre-generated Software Bill of Materials (SBOM).

```bash

# Analyze the current repository with human-readable output

python engineering/dependency-auditor/scripts/license_checker.py . \
    --format text \
    --policy strict \
    --warn-conflicts

```

Key flags include:
- **`--format`**: Selects `text` for console-friendly reports or `json` for machine parsing.
- **`--policy strict`**: Enforces a compliance threshold (score below 80 exits with status 1).
- **`--warn-conflicts`**: Forces exit code 2 when any license conflict is detected, enabling CI gates to block merges.
- **`--inventory`**: Accepts a path to a pre-generated JSON dependency file instead of scanning [`package.json`](https://github.com/alirezarezvani/claude-skills/blob/main/package.json) directly.

### Programmatic Usage

For custom workflows, instantiate `LicenseChecker` and call `analyze_project()`:

```python
from pathlib import Path
from engineering.dependency-auditor.scripts.license_checker import LicenseChecker

checker = LicenseChecker()
result = checker.analyze_project(Path("/my/project"))

print(result["compliance_score"])        # Numeric score 0-100

print(result["conflicts"])               # List of LicenseConflict objects

print("\n".join(result["recommendations"]))  # Actionable remediation advice

```

The `analyze_project()` method returns a rich dictionary containing the detected project license, dependency license resolutions, a summary distribution, flagged conflicts, and scored recommendations.

### Working with Pre-Generated Inventories

If your organization already generates dependency inventories via external SBOM tools, bypass the built-in scanner using `_load_dependency_inventory()`:

```bash
python engineering/dependency-auditor/scripts/license_checker.py . \
    --inventory path/to/deps.json \
    --format json \
    > compliance-report.json

```

This JSON output integrates directly with dashboards, policy-enforcement bots, or legal review workflows.

## Understanding the Compliance Report

The `generate_report()` method formats audit results into structured sections: a high-level summary, license distribution statistics, explicit conflict listings, high-risk dependencies, and prioritized recommendations. When `--format text` is selected, the report renders console-friendly tables; when `--format json` is selected, the output becomes a parseable object containing the same semantic data.

Because the tool uses only Python’s standard library, it remains portable across any environment where Claude Skills is installed, from developer laptops to locked-down CI runners. Adding support for additional ecosystems—such as Python [`requirements.txt`](https://github.com/alirezarezvani/claude-skills/blob/main/requirements.txt) or Go `go.mod`—requires implementing a new scanner that returns the list-of-dicts structure expected by `_analyze_dependency_license()`, without altering the core checker logic.

## Summary

- The **`LicenseChecker`** class in [`engineering/dependency-auditor/scripts/license_checker.py`](https://github.com/alirezarezvani/claude-skills/blob/main/engineering/dependency-auditor/scripts/license_checker.py) provides a pure-Python engine for dependency auditing and license compliance checking.
- It combines a **canonical license database** (SPDX identifiers), a **compatibility matrix**, and **regex pattern detection** to resolve license ambiguities.
- The CLI supports **strict policy enforcement** with non-zero exit codes for CI/CD integration, while the Python API allows **programmatic analysis** via `analyze_project()`.
- The tool accepts both **live project scans** (e.g., [`package.json`](https://github.com/alirezarezvani/claude-skills/blob/main/package.json)) and **pre-generated JSON inventories** via the `--inventory` flag.
- Supporting files such as [`dep_scanner.py`](https://github.com/alirezarezvani/claude-skills/blob/main/dep_scanner.py), [`upgrade_planner.py`](https://github.com/alirezarezvani/claude-skills/blob/main/upgrade_planner.py), and [`license_compatibility_matrix.md`](https://github.com/alirezarezvani/claude-skills/blob/main/license_compatibility_matrix.md) provide extension points for multi-ecosystem support and security-risk analysis.

## Frequently Asked Questions

### What license formats does the tool recognize?

The checker recognizes standard **SPDX identifiers** (e.g., MIT, Apache-2.0, GPL-2.0) through its internal database built by `_build_license_database()`. For non-standard declarations, it employs `_detect_license_from_text()` with regex patterns constructed in `_build_license_patterns()` to match common license boilerplate inside plain-text files.

### How does the compliance scoring work?

The `analyze_project()` method calculates a **numeric compliance score between 0 and 100** based on the ratio of permissive versus copyleft licenses, detected conflicts, and risk-weighted obligations. When the CLI runs with `--policy strict`, the tool exits with status 1 if the score falls below 80, preventing releases that fail organizational standards.

### Can I integrate this into CI/CD pipelines?

Yes. The `main()` entry point returns specific **exit codes** for automation: status 1 for strict policy violations (low compliance scores) and status 2 for detected conflicts when `--warn-conflicts` is enabled. These codes allow build systems to gate merges, trigger legal review workflows, or generate artifacts for compliance dashboards.

### How do I add support for other package managers?

Extending the tool requires implementing a new scanner function that returns the same **list-of-dicts structure** consumed by `_analyze_dependency_license()`. Because `LicenseChecker` isolates ingestion logic from analysis logic, you can add Python [`requirements.txt`](https://github.com/alirezarezvani/claude-skills/blob/main/requirements.txt) or Rust [`Cargo.toml`](https://github.com/alirezarezvani/claude-skills/blob/main/Cargo.toml) support by modifying [`dep_scanner.py`](https://github.com/alirezarezvani/claude-skills/blob/main/dep_scanner.py) or creating a new module without touching the core compatibility engine in [`license_checker.py`](https://github.com/alirezarezvani/claude-skills/blob/main/license_checker.py).